spiffe/cert/
parsing.rs

1use crate::cert::errors::CertificateError;
2use crate::cert::Certificate;
3use x509_parser::certificate::X509Certificate;
4use x509_parser::der_parser::oid::Oid;
5use x509_parser::error::X509Error;
6use x509_parser::extensions::ParsedExtension;
7use x509_parser::nom::Err;
8use x509_parser::nom::Err::Incomplete;
9
10/// Takes a concatenated chain of DER encoded certificates and parses it
11/// as a `Vec` of [`Certificate`].
12pub(crate) fn to_certificate_vec(
13    cert_chain_der: &[u8],
14) -> Result<Vec<Certificate>, CertificateError> {
15    let cert_der_blocks = asn1::from_der(cert_chain_der)?;
16
17    let mut cert_chain = vec![];
18    for block in cert_der_blocks.iter() {
19        let cert_der = asn1::to_der(block)?;
20        cert_chain.push(Certificate::from_der_bytes(cert_der));
21    }
22    Ok(cert_chain)
23}
24
25/// Try to parse the given DER-encoded slice of bytes as a X.509 certificate.
26/// Returns a [`CertificateError`] if the the `der_bytes` is not DER-encoded or if
27/// it cannot be parsed to a X.509 certificate.
28pub(crate) fn parse_der_encoded_bytes_as_x509_certificate(
29    der_bytes: &[u8],
30) -> Result<X509Certificate<'_>, CertificateError> {
31    let x509 = match x509_parser::parse_x509_certificate(der_bytes) {
32        Ok(c) => c.1,
33        Err(e) => {
34            return Err(CertificateError::ParseX509Certificate(match e {
35                Incomplete(_) => X509Error::InvalidCertificate,
36                Err::Error(e) => e,
37                Err::Failure(e) => e,
38            }))
39        }
40    };
41    Ok(x509)
42}
43
44// Returns the X.509 extension in the certificate the for the provided OID.
45pub(crate) fn get_x509_extension<'a>(
46    cert: &'a X509Certificate<'_>,
47    oid: Oid<'a>,
48) -> Result<&'a ParsedExtension<'a>, CertificateError> {
49    let parsed_extension = match cert.tbs_certificate.get_extension_unique(&oid)? {
50        None => return Err(CertificateError::MissingX509Extension(oid.to_string())),
51        Some(s) => s.parsed_extension(),
52    };
53    Ok(parsed_extension)
54}
spiffe/cert/parsing.rs

spiffe/cert/
parsing.rs
